import { type AuthMaterial, type Json, type Membership, type PermissionGrant } from "../core/index.js";
import type { ConformanceSuite } from "../core/conformance/index.js";
import type { HostAuthPreset } from "./shared.js";
/**
 * 09-vendo §2.1 — executable three-seam checks for a HostAuthPreset: the preset
 * must behave exactly like the hand-written per-seam trio it replaces. Built on
 * the core conformance kit's framework-agnostic shape (`@vendoai/vendo/core/conformance`),
 * so every named preset (authJs today; clerk/supabase/auth0/jwt as they land)
 * runs the SAME suite: mount with `for (const c of suite.cases) it(c.name, c.run)`
 * or execute via `runConformance`.
 *
 * The suite asserts host-integrated behavior — the preset under test must be
 * configured with a subject→user resolver (or provider-side equivalent) that
 * knows `knownSubject` and has never issued `unknownSubject`.
 */
export interface HostAuthPresetConformanceOptions {
    preset: HostAuthPreset;
    /** Build a wire Request carrying a VALID host session for the subject. */
    sessionRequest(subject: string): Request | Promise<Request>;
    /** A request with no host session. Default: a bare GET with no credentials. */
    anonymousRequest?(): Request;
    /** A subject the host knows: sessions resolve, actAs mints, the door resolves. */
    knownSubject: string;
    /** A subject the host never issued: actAs declines, the door's lookup returns null. */
    unknownSubject: string;
    /** When set, principals resolved for `knownSubject` must carry exactly this display. */
    expectedDisplay?: string;
    /** The grant actAs minting is exercised with. Default: a standing tool grant
        for the subject under test. */
    grant?(subject: string): PermissionGrant;
    /** Out-of-band verification for the actAs round-trip case. Cookie-minting
        presets (authJs, supabase, jwt) mint AuthMaterial their own `principal`
        resolver accepts, so the default round-trips through it — but
        producer/verify-split systems (clerk/auth0, 04 §2.1) mint away-tokens whose
        verifier is host-mounted middleware, not the preset. Supply the split
        system's verify half here; return the verified subject, or null when
        verification rejects the material. */
    verifyActAs?(material: AuthMaterial): Promise<string | null> | string | null;
    /** Build contract §9.1 — set when the preset under test was configured with a
        `memberships` callback: the orgs/teams it must assert for `knownSubject`.
        Unset, the memberships case asserts the seam stays cleanly absent (no
        orgs asserted ⇒ `can()` degenerates to ownership). */
    expectedMemberships?: Membership[];
    /** Spec 2026-08-05 §1 — set when the preset under test was configured with a
        facts-returning user resolver: what `facts` must resolve for
        `knownSubject`. Unset, the case asserts the seam exists (every composed
        preset carries it) and stays cleanly empty. */
    expectedFacts?: Record<string, Json>;
}
/** Executable HostAuthPreset checks from 09-vendo §2.1 (plus 01-core §13 for the
    actAs half and 10-mcp §3 for the oauth half). */
export declare function hostAuthPresetConformance(opts: HostAuthPresetConformanceOptions): ConformanceSuite;